Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 18 Jun 2011 22:28:12 +0400
From: Vasiliy Kulikov <>
Subject: Re: proc info restrictions problem


On Sat, Jun 18, 2011 at 14:42 +0400, Vasiliy Kulikov wrote:
> I feel doubt whether ptrace_may_access() may be changed to something
> more simple.  Both -ow and -grsecurity use changed posix permissions and
> gid on procfs files, so maybe just match subject's euid vs. object's uid?

Another choise - remove hidepid=2 at all.  As proc connector uses struct
proc_event as an information send to listeners, hidepid=1 is not related
to proc connector:

It means that with hidepid=1 only procfs and taskstats should be
restricted.  Taskstats uses direct "unicast" information sending, so
ptrace_task_may_access_current() and ptrace_may_access() should work
(with a patch I've recently sent to lsm list as RFC).

It is sad that hidepid=2 is losen and processes may spy on other users'
processes, but I don't see any technical solution for hidepid=2 and
cn_proc problem.


Vasiliy Kulikov - bringing security into open computing environments

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.